panic: "xfer->ux_state == XFER_ONQU" failed

[Timo Buhrmester <fstd.lkml%gmail.com@localhost>]

As of late, I'm getting a lot of this:
| panic: kernel diagnostic assertion "xfer->ux_state == XFER_ONQU" failed: file "/usr/src/sys/dev/usb/usbdi.c", line 910 
when unplugging my USB keyboard (incl. mouse connected to the keyboard's
integrated USB hub.)  This seems to have gotten worse as of upgrading
to the latest -current (7.99.41/i386 as of yesterday (Oct 30, 2016).

Captured on the serial console:
| fatal breakpoint trap in supervisor mode
| trap type 1 code 0 eip c010e7a4 cs 8 eflags 200246 cr2 bbbdb054 ilevel 0 esp dd109cd4
| curlwp 0xc53c7540 pid 0 lid 55 lowest kstack 0xdd1072c0
| Stopped in pid 0.55 (system) at netbsd:breakpoint+0x4:  popl    %ebp
| db{0}> bt
| breakpoint(c0f8b976,c131e5a0,c0f3de30,dd109cf0,c53d4d48,0,1,dd109ce4,c0c988ff,c0f3de30) at netbsd:breakpoint+0x4
| vpanic(c0f3de30,dd109cf0,dd109d28,c03837b0,c0f3de30,c0f3dd97,c0f872ac,c0f871a5,38e,c53d4d48) at netbsd:vpanic+0x121
| cd_play_msf(c0f3de30,c0f3dd97,c0f872ac,c0f871a5,38e,c53d4d48,c5269268,ba80,0,c53fc660) at netbsd:cd_play_msf
| usb_transfer_complete(c53d4d48,a80,4,5,c4c692a0,c5269268,dc8bba98,439c3b00,dc8bba80,c5269008) at netbsd:usb_transfer_complete+0x256
| ohci_abort_xfer(c53d4d48,c08dd53b,0,c53fc660,1,c53fc660,dd109da8,c038333c,c5269268,c091d2f4) at netbsd:ohci_abort_xfer+0x262
| usbd_ar_pipe(c5269268,c091d2f4,6,ffffffff,ffffffff,d03adb88,1,dd109dcc,c0395b91,c53fc660) at netbsd:usbd_ar_pipe+0x35
| usbd_abort_pipe(c53fc660,c08dd839,c131d7c2,c131d7c2,d03adb88,1,c1251520,dd109e04,c0907ab4,d03adb88) at netbsd:usbd_abort_pipe+0x26
| uhidev_detach(d03adb88,1,1,c54453e8,1c,dd109e04,c0387680,c54453e8,7c,0) at netbsd:uhidev_detach+0x29
| config_detach(d03adb88,1,10,c5260030,c08d0010,c700ca24,d1316cf8,d03adb88,64696875,317665) at netbsd:config_detach+0xe2
| usb_disconnect_port(d1316cf8,c700ca08,1,c7252fc8,d1316c98,3,c700ca08,1,c12515c0,dd109eb0) at netbsd:usb_disconnect_port+0xa0
| uhub_detach(c700ca08,1,0,1388,dd109eec,0,0,0,0,0) at netbsd:uhub_detach+0x6a
| config_detach(c700ca08,1,10,dd109eec,0,c53ce864,c53fa0f0,c700ca08,62756875,c0380039) at netbsd:config_detach+0xe2
| usb_disconnect_port(c53fa0f0,c53ce848,1,c53c7540,0,0,c53fa0c0,3,100,c53fa0f0) at netbsd:usb_disconnect_port+0xa0
| uhub_explore(c527f238,c1222dd0,c53c7540,c4c66d40,c50ffde8,c50ffde8,c50ffdc8,dd109f8c,c0381b6f,c5269234) at netbsd:uhub_explore+0x1e3
| usb_discover.isra.2(c5269234,c5269268,1770,c50ffdc8,c0381af7,0,c0100411,c50ffdc8,14b3000,14be000) at netbsd:usb_discover.isra.2+0x4b
| usb_event_thread(c50ffdc8,14b3000,14be000,0,c01003f3,0,0,0,0,0) at netbsd:usb_event_thread+0x78
| db{0}> show reg
| ds          c0910010    disk_set_info+0x1be
| es          10
| fs          30
| gs          c0f30010    nv50_i2c_func+0x30
| edi         dd109cf0
| esi         c0f3de30    ostype+0x108
| ebp         dd109cb0
| ebx         104
| edx         8
| ecx         0
| eax         1
| eip         c010e7a4    breakpoint+0x4
| cs          8
| eflags      200246
| esp         dd109cb0
| ss          10
| netbsd:breakpoint+0x4:  popl    %ebp
| db{0}> sync

It FEELS like this happens more frequently when the system is under load,
at least I haven't yet seen it happen when re-plugging my keyboard/mouse
while the system was mostly idle.

What's the sorcery?